Skip to content
This repository has been archived by the owner on May 12, 2021. It is now read-only.

METRON-838 Incorrect set of ts in FireEye parser #528

Closed
wants to merge 6 commits into from
Closed

METRON-838 Incorrect set of ts in FireEye parser #528

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
68bbb52
Set correct TS for FireEye parser
bjigmp Apr 10, 2017
eaaba59
Merge branch 'master' of https://github.com/apache/incubator-metron
bjigmp Jul 21, 2017
59a79ad
Added unit test for FireEye
bjigmp Jul 21, 2017
28ad89f
Merge branch 'master' of https://github.com/apache/incubator-metron
bjigmp Aug 1, 2017
beaed9e
Merge branch 'master' of https://github.com/apache/incubator-metron
bjigmp Aug 7, 2017
63a0281
Use ZoneOffset.UTC instead of ZoneId.of
bjigmp Aug 7, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 3 additions & 5 deletions ...rm/metron-parsers/src/main/java/org/apache/metron/parsers/fireeye/BasicFireEyeParser.java
View file
Open in desktop
Expand Up @@ -122,14 +122,12 @@ private long getTimeStamp(String toParse,String delimiter) throws ParseException
month = tsMatcher.group(1);
day = tsMatcher.group(2);
time = tsMatcher.group(3);

} else {
LOG.warn("Unable to find timestamp in message: {}", toParse);
ts = ParserUtils.convertToEpoch(month, day, time, true);
} else {
LOG.warn("Unable to find timestamp in message: {}", toParse);
}

return ts;

return ts;
}

private JSONObject parseMessage(String toParse) {
Expand Down
17 changes: 17 additions & 0 deletions ...etron-parsers/src/test/java/org/apache/metron/parsers/fireeye/BasicFireEyeParserTest.java
View file
Open in desktop
Expand Up @@ -19,6 +19,10 @@

import java.util.Map;
import java.util.Map.Entry;
import java.time.Year;
import java.time.ZoneId;
import java.time.ZonedDateTime;

import org.apache.metron.parsers.AbstractParserConfigTest;
import org.json.simple.JSONObject;
import org.json.simple.parser.JSONParser;
Expand All @@ -28,6 +32,7 @@
import org.junit.Test;

public class BasicFireEyeParserTest extends AbstractParserConfigTest {
private static final ZoneId UTC = ZoneId.of("UTC");

@Before
public void setUp() throws Exception {
Expand Down Expand Up @@ -57,4 +62,16 @@ public void testParse() throws ParseException {
}
}
}

private final static String fireeyeMessage = "<164>Mar 19 05:24:39 10.220.15.15 fenotify-851983.alert: CEF:0|FireEye|CMS|7.2.1.244420|DM|domain-match|1|rt=Feb 09 2015 12:28:26 UTC dvc=10.201.78.57 cn3Label=cncPort cn3=53 cn2Label=sid cn2=80494706 shost=dev001srv02.example.com proto=udp cs5Label=cncHost cs5=mfdclk001.org dvchost=DEVFEYE1 spt=54527 dvc=10.100.25.16 smac=00:00:0c:07:ac:00 cn1Label=vlan cn1=0 externalId=851983 cs4Label=link cs4=https://DEVCMS01.example.com/event_stream/events_for_bot?ev_id\\=851983 dmac=00:1d:a2:af:32:a1 cs1Label=sname cs1=Trojan.Generic.DNS";

@SuppressWarnings("rawtypes")
@Test
public void testTimestampParsing() throws ParseException {
JSONObject parsed = parser.parse(fireeyeMessage.getBytes()).get(0);
JSONParser parser = new JSONParser();
Map json = (Map) parser.parse(parsed.toJSONString());
long expectedTimestamp = ZonedDateTime.of(Year.now(UTC).getValue(), 3, 19, 5, 24, 39, 0, UTC).toInstant().toEpochMilli();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's incredibly minor (and optional), but we could just swap out the ZoneId.of("UTC") for ZoneOffset.UTC

At that point, this changes slightly, but still seems reasonable

    long expectedTimestamp = ZonedDateTime.of(
        Year.now(ZoneOffset.UTC).getValue(),
        3,
        19,
        5,
        24,
        39,
        0,
        ZoneOffset.UTC
    ).toInstant().toEpochMilli();

Assert.assertEquals(expectedTimestamp, json.get("timestamp"));
}
}